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About this guide 
About Qualys 


About this guide 


Welcome to Qualys Consultant Scanner - Personal Edition! This lightweight and easy to 
install Scanner helps you scan your internal networks for security issues using the Qualys 
Cloud Platform. 


About Qualys 


Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud-based security and 
compliance solutions. The Qualys Cloud Platform and its integrated apps help businesses 
simplify security operations and lower the cost of compliance by delivering critical 
security intelligence on demand and automating the full spectrum of auditing, 
compliance and protection for IT systems and web applications. 


Founded in 1999, Qualys has established strategic partnerships with leading managed 
service providers and consulting organizations including Accenture, BT, Cognizant 
Technology Solutions, Deutsche Telekom, Fujitsu, HCL, HP Enterprise, IBM, Infosys, NTT, 
Optiv, SecureWorks, Tata Communications, Verizon and Wipro. The company is also a 
founding member of the Cloud Security Alliance (CSA). 


For more information, please visit www.qualys.com 


Qualys Support 


Qualys is committed to providing you with the most thorough support. Through online 
documentation, telephone help, and direct email support, Qualys ensures that your 
questions will be answered in the fastest time possible. We support you 7 days a week, 
24 hours a day. Access support information at www.qualys.com/support/ 
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Quick Start 


Welcome to Qualys Consultant Scanner - Personal Edition! This hghtweight Scanner 
Appliance is perfectly suited for consultants using the Qualys Cloud Platform to provide 
vulnerability and compliance services for their clients. 


Scanner to take on the go! 

- Super compact and lightweight 

- Plugin any VGA monitor and access the built-in console 
- Activate in minutes - DHCP is enabled by default 

- Easily configure as needed - static IP, proxy, and more 


- Bind/unbind with different subscriptions, unlimited times 


© Qualys. 


Cloud Platform 


Customer Network 


VGA monitor 
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Scanner Console 


What you’ll need 
Consultant Scanner - Personal Edition packaging from Qualys. 


Qualys Cloud Suite account with Consultant Scanner - Personal Edition enabled. Manager 
or Unit Manager role is required. Interested in Consultant Scanner - Personal Edition? Sure 
just reach out to Qualys Support or your Qualys Account Manager. 


VGA monitor to connect to Qualys Consultant Scanner - Personal Edition. 


USB keyboard to connect to Qualys Consultant Scanner - Personal Edition. 
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Quick Look at the Scanner 


Front panel 


The Scanners front panel gives you operational indicators. 


1 - These LEDs tell you about the WAN interface which is disabled by default. When split 
network configuration is enabled for your scanner the left LED is lit (blinking) when there 
is WAN interface activity and the right LED is ht (solid) when the WAN interface is 
enabled. Learn more 


2 - These LEDs tell you about the LAN interface which is enabled. The left LED is lit 
(blinking) when there is LAN interface activity and the nght LED is lit (solid) when the LAN 
interface is enabled. 


Disk - This LED is lit (blinking) when there is disk activity. 
POWER - This LED is lit (solid) when the scanner is powered on. 


Back panel 


The Scanner’s back panel includes: a power switch, a power socket, VGA socket, two USB 
ports, Ethernet LAN and WAN ports. (Note - The “Serial” Ethernet port shown is not in use; 
there is no Serial support on this scanner. The only way to have scanner console access 1s 
to connect a monitor to the VGA port and a keyboard to one of the USB ports.) 


Your Scanner package from Qualys also includes accessories for proper set up in your 
networking environment. 


Looking for more details? See Product Specifications and Credits 
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Network requirements 


Bandwidth 


Minimum recommended bandwidth connection of 
1.5 megabits per second (Mbps) to the Qualys Cloud Platform. 


Outbound HTTPS Access 


The local network must be configured to allow outbound 
HTTPS (port 443) access to the Internet, so that the Scanner 
Appliance can communicate with the Qualys Cloud Platform. 


Network Mode 


By default when you deploy a Scanner Appliance it will be in 
IPv4+v6 network mode. If your network is configured in a way 
that only IPv6 addresses can be used, then you Il need to 
switch to IPv6-only mode. See Enable IPv6-only Mode. 


Access to Qualys Cloud Plat- 
form 


The Scanner Appliance must be able to reach certain 
infrastructure located at the Qualys Cloud Platform where 
your Qualys account is located. 


Tip - Log in to the Qualys portal and go to Help > About to see 
the Qualys Cloud Platform servers that need to be whitelisted. 


Access to 
Target Assets 


The assets to be scanned (IP addresses, web applications) 
must be accessible to the Scanner Appliance. 


DHCP (default) or Static IP 


Proxy Support 


By default the Scanner Appliance is pre-configured with 
DHCP. If configured with a static IP address, be sure you have 
the IP address, netmask, default gateway, primary DNS and 
WINS server (if appropriate). Learn more 


The Scanner Appliance includes Proxy support with or 
without authentication - Basic or NTLM. The Proxy server 
must be assigned a static IP address and must allow 
transparent SSL tunneling. Proxy-level termination (as 
implemented in SSL bridging, for example) is not supported. 
Learn more 


LAN Interface (default) or 
Split Network config 


The LAN interface services both scanning traffic and 
management traffic to the Qualys Cloud Platform, unless Split 
Network configuration is enabled. Learn more 


WINS Support 


VLAN Support 


If your network is running Windows Internet Naming Service 
(WINS), the Scanner Appliance needs to use it for host name 
resolution during scanning. Using a static IP address, the 
WINS servers are defined with the static IP settings using the 
Scanner Console. Learn more 


These options are supported 

- Static and DHCP LAN configuration with native VLAN. 

- VLANs defined using the Qualys Cloud Platform UI. Learn 
more 
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Tell me the steps 


1- Get your Activation Code 


You'll find the Activation Code on the Qualys sticker fastened to your Scanner. 


2 - Log in to Qualys Cloud Suite UI and enter your Activation Code 
Go to Scans > Appliances and take these steps. 

1) Select New > Scanner Appliance 

& Qualys. Enterprise 


Vulnerability Management v 


Dashboard Scans Reports Remediation Assets Knowledg 


© Scans Scans Maps Schedules Appliances Option À 
| New v | Search @ 


a ID 
Virtual Scanner Appliance... 


Replace Scanner Appliance... ẹ Internal network scanning requires a scanner appliance. 
+ 


+ 
+ 
Download... t. 


% Activate Scanner Appliance LaunchHelp [al x 


Activate Scanner Appliance 
2) Enter Activation Code 
3) Click Activate 


Enter the activation code shown in the LCD panel of your appliance, after 
you plugged itin. 


Activation Code: * | 12345123451234| e 


cane @ 


Are you a Unit Manager? 


For the activation step you Il need to select an asset group to add the Scanner to. This will 
make the scanner available to all Unit Managers in your business unit. 


3 - Power on the Scanner 


Upon success you ll see the Scanner Appliance name and IP address. This appears only 
after the scanner makes a successful connection to the Qualys Cloud Platform. 


~~ | We'll attempt to connect 
© Qualys. Scanner Console the appliance to the Qualys 


Cloud Platform using DHCP 


Name: vScanner, LAN IP: 10. by default. 


Use the Scanner Console to 
configure network settings 
as needed. Learn more 
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Tip - Check Scanner status in Qualys UI 


Just log in to Qualys Cloud Suite and go to Scans > Appliances. You'll see your new 
Scanner in the appliances list. 


Good to Know - It can take a few minutes for the Qualys user interface to get updated 
after you add a new scanner appliance. Please refresh your browser periodically to ensure 
that you are seeing the most up to date info. 


(9) Scans | Scans Maps Schedules Appliances Option Profiles Authentication Search Lists 


New 2e | Search 1-20 of 121 D Tv gesa: 
Appliance ID a LANIP WAN IP LAN IPv6 Polling Scanner Signatures Last Update @ 
@ “ is_sfagd_sg1 0 10.1.0.54 -- 180 9.3.38-1 24482 05/24/2017 at 13:48:15 (GMT-0700) = ĝ 
seconds 


New_Enc_VSA_3 15618999429829 10.11.53.252 — 2001:470:8418:b35::a0b:35fc/64 180 9.3.38-1 2.4.48-2 05/24/2017 at 12:56:07 (GMT-0700) > Ųų 


A 
is_sfagd_sg1 
ID: 0 


Owner (Manager) | Connected on: 05/24/2017 at 15:17:12 (GMT-0700) | Verified on: 05/24/2017 at 15:20:02 (GMT-0700) | Connected 


Summary: The appliance is online and its software versions are up to date 


Heartbeat Checks Missed Latest Scanner Version Latest Signature Version Available Capacity 


0 9.3.38-1 2.4.48-2 100% 


1- # Activation is complete. Now you can start internal scans! (You'll see the busy icon 
is greyed out until you launch a scan using this appliance). 


2 - This icon tells you it is a physical scanner appliance. 
3 - Latest software versions - these are installed as part of the activation process. 


4 - The available capacity will be 100% until you launch a scan. You can come back and 
check this at any time. 
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Configuration options 


You might need to customize the out of box configuration in order for successful 
activation to occur. The Scanner Console is used to configure network settings like static 
IP address, proxy server, and VLAN tag, and power on/off. 


Configuration may be required for activation 


Keep in mind your Scanner must be able reach our Cloud Security Platform via HTTPS - 
this is required for successful activation. Depending on your network, you might need to 
configure network settings using the Scanner Console so that activation can occur 
successfully. 


How do I enter settings? Press the Up and Down arrows to select input fields. Press the 
Right and Left arrows to scroll within a field. When you are done, select the last item, for 
example “Configure static IP address on LAN?” and type Y to confirm (or N to cancel). 


How to configure a static IP address 


By default your Scanner 1s configured with DHCP. You can define a static IP address 
instead of DHCP. Using IPv6-only mode? Please see Network Settings in [Pv6-only Mode. 


What are the steps? Access the Scanner Console. Press the Down arrow to select “Set up 
network (LAN)” from the main menu. Press the Right arrow to highlight “Enable static IPv4 
config’. Press the Right arrow. Enter settings (use the Up/Down arrows to move thru the 
settings). When “Apply static IPv4 configuration on LAN?” is selected type Y to confirm. 


© Qualys. Scanner Console 


Name: vScanner, LAN IP: 10. 


Set up network (LAN) > Enable static IPv4 config > LAN address 10 
Enable WAN interface > Renew DHCP on LAN LAN prefix 24 


f ae cr. mi ERS ai AA AKL ~ = ar 
ChaDIe Proxy cnadie VLAN ON LAN LAIN gateway U 


Cuctarn rahant AA ANNIC 4 
system redoo LAIN VVIIND UUUU 


Lin pp A À Asin IC } m "y P r 
Jersior LAN WINS2 0.0.0.0 
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How to configure IPv6 address for scanning 


This applies when you re in the default IPv4+v6 mode. Interested in only using IPv6? See 
Enable IPv6-only Mode. 


You have the option to configure the Scanner with an IPv6 address on the LAN interface - 
this will be used for scanning IPv6 hosts. 

Account requirements 

The IPv6 Scanning feature must be enabled for your subscription. 


How it works 


Once configured scanning traffic will be routed through the LAN interface 
- LAN IPv4 interface for scanning IPv4 hosts, and 
- LAN IPv6 interface for scanning IPv6 hosts 


All management traffic (software updates, health checks, etc) will be routed through the 
LAN IPv4 interface. 


1- Complete the Quick Start 


Follow the Quick Start steps, described in this user guide, to activate your Scanner. Be sure 
your Scanner has successfully connected to the Qualys Cloud Platform. Learn more 


Good to Know - Your Scanner must be configured using DHCP or a static IPv4 address 
before you can configure an IPv6 address for scanning. 


2 - Edit Scanner settings using Qualys UI 
Log in to Qualys portal. Go to Scans > Appliances and edit your Scanner Appliance. 


Edit Scanner Appliance Launch Help x 


General Information 


LAN Settings 


IPv6 Settings 
E e for this scanne: 


1) Select “Enable IPv6 for this scanner”. (Don't see IPv6 Settings? This means the IPv6 
Scanning feature is not turned on for your account. Contact Support or your Technical 
Account Manager to get this feature.) 


2) Choose “Automatically” and we'll do IP assignment through router advertisement, or 
choose “Static” and assign a static IP address. 


3) Click Save to save the settings with IPv6 configuration. 
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VLAN configuration 

This is supported in IPv4+v6 network mode (the default) and IPv6-only mode. 
These options are supported: 

- Static and DHCP LAN configuration with native VLAN. 

- VLANs defined using the Qualys Cloud Platform UI (see steps below). 


Steps to define VLANS using Qualys Cloud Platform UI 


Log in to Qualys portal. Go to Scans > Appliances and edit the settings. You can add up to 
4094 VLANs to devices with a serial number over 29000 and up to 99 VLANs to devices 
with a serial number under 29000. Add up to 99 static routes. Don t see these settings in 
the UI? The VLAN trunking feature must be turned on for your account. Please contact 
Support or your Technical Account Representative if you'd like us to turn it on for you. 


Proxy configuration 
Proxy configuration is supported in IPv4+v6 mode (the default) and IPv6-only mode. 


The Scanner includes Proxy support with or without authentication - Basic or NTLM. The 
Proxy server must allow transparent SSL tunneling. Proxy-level termination (as 
implemented in SSL bridging, for example) is not supported. SOCKS proxies are not 
supported. 


What are the steps? Access the Scanner Console. Select “Enable proxy’, then “Change 
proxy params”, then Proxy parameters’. Press the Right arrow and enter proxy settings. 
You can enter the IPv4 address or the FQDN for the proxy server. 


© Qualys. Scanner Console 


Name: vScanner, LAN IP: 10. 


Set up network (LAN) > 

Enable WAN interface > 

Change proxy params > Proxy parameters > 
Reset network Settings > r 

System shutdown > Proxy user proxy_user 
System reboot r 

Version 


Exit this menu? (Y/N) Really enable proxy? (Y/N) 
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Split Network configuration 


Split network configuration is supported only in IPv4+v6 mode (the default). It is not 
supported in IPv6-only mode. 


By default the Scanner LAN interface services all traffic to the Qualys Cloud Platform, 
including management traffic (software updates, health check, scan data upload) and 
scanning traffic. 


Corporate Intranet 


Intranet Scanner 


Internet 


You have the option to configure a split network configuration for your Scanner by 
configuring the WAN interface using the Scanner Console. This enables support for 
networks that do not have direct Internet access. Split network configuration also keeps 
scanned data and internal targets secure by isolating internal LAN traffic from Internet 
traffic by using the WAN interface. 


Once configured, management traffic will be routed through the WAN interface and 
scanning traffic will be routed through the LAN interface. No internal traffic will be routed 
or bridged to the WAN interface, and no management traffic will be routed or bridged to 
the LAN interface. 


Corporate Intranet 


Intranet Scanner 


Internet 


Please review these tips and best practices before you configure split network 
configuration. 


e Check to be sure that network connection to both the LAN and WAN interfaces on 
the Virtual Scanner have been set up properly. 


e The Virtual Scanner must be configured with DHCP or a static IP address on the 
LAN interface first. 


e Do not configure the LAN and WAN interfaces on the same subnet. This type of 
configuration is not supported. 
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Configuration options 


What are the steps? Access the Scanner Console. Navigate to “Enable WAN Interface’, 
press the Right arrow and provide the required settings. Once configured, all software 
updates and health checks are routed through the WAN interface and scanning traffic is 


routed through the LAN interface. 


Qualys. Scanner Console 


Name: vScanner, LAN IP: 10. 


Set up network (LAN) > 

Enable WAN interface > Enable static IPv4 config > 
Enable proxy > Enable DHCP on WAN > 
Reset network settings > 

System shutdown > 

System reboot > 

Version 

Exit this menu? (Y/N) 


TIP: 


WAN address 
WAN prefix 
WAN gateway 
WAN DNS1 
WAN DNS2 


10 
24 


0.0.0.0 
0.0.0.0 


Apply static IPv4 configuration on WAN? (Y/N) 


This menu is to configure a static IPv4 address for the scanner on the WAN interface. 

Press UP/DOWN arrow keys to select input fields. When entry is highlighted, text can be typed over. 
Use the LEFT, RIGHT, HOME and END keys to scroll within each input field. 
To apply changes, select the last menu item and type 'Y' to configure static IPv4 address. 
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Enable IPv6-only Mode 


When you deploy a scanner appliance, it works in IPv4+v6 mode by default. You have the 
option to enable IPv6-only mode. When you enable IPv6-only mode, all communications 

will use IPv6 addresses instead of IPv4 addresses, and you'll see additional menu options 
in the Scanner Console for IPv6 network and proxy configurations. 


Step 1 - Reset to IPv6-only mode 


The first step you ll need to take is to reset the network configuration to use IPv6-only 
mode. Access the Scanner Console, and select “Reset network settings’, and then “Reset to 
IPv6 only mode?”. Type Y to confirm (or type N to cancel). 


© Qualys. Scanner Console 


Reset network settings > Reset all settir 


Step 2 - Configure network and proxy settings (optional) 


In IPv6-only mode, you have the option to configure the scanner network interface with 
either a manual or automatic IPv6 configuration. IPv6-only mode supports proxy and 


VLAN configurations. Proxy and VLAN configurations work the same whether you re in 
IPv4+v6 mode or IPv6-only mode. See the following sections for details: 


Network Settings in IPv6-only Mode 
VLAN configuration 


Configure a Proxy Server in IPv6-only Mode (Optional) 
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Network Settings in IPv6-only Mode 


When in IPv6-only mode, configure the scanner network interface either with manual or 
automatic IPv6 network configuration. Automatic IPv6 is used by default. 


Configure the scanner with automatic IPv6 
Automatic IPv6 is the default network configuration for a scanner in IPv6-only mode. 


When using automatic IPv6 we'll do IPv6 address assignment through both router 
advertisement and DHCPv6. Even with automatic IPv6 configuration, you have an option 
to configure manual DNS resolvers for your scanner. If configured manually, IPv6 DNS1 
and IPv6 DNS2 resolvers will take precedence over the DNS resolvers acquired from 
DHCPv6 and RADVD. 


Configure the scanner with manual IPv6 


If automatic IPv6 address assignment is not available on your network, you must enable 
the scanner with a manual IPv6 address. One of these configurations is required. Note: For 
a valid network configuration, you should configure at least one IPv6 DNS resolver. 


Access the Scanner Console. Navigate to “Set up network (LAN)”, and then “Enable manual 
IPv6 config”. Press the Right arrow and enter the following settings: Manual address, IPv6 
prefix, IPv6 gateway, IPv6 DNS1 and IPv6 DNS2. When you're done entering settings, select 
“Apply the manual IPv6 configuration on LAN?” and type Y to confirm (or N to cancel). 


Set up network (LAN) > Enable manual F6 config > Manual addre 260 c02 102113242650 56fffe9af 
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Configure a Proxy Server in IPv6-only Mode (Optional) 


Follow these steps below to configure proxy configuration in IPv6-only mode. 


Access the Scanner Console. Select “Enable Proxy”, then “Change proxy params’, then 
“Proxy parameters”. Press the Right arrow to enter proxy settings. When you're done, 
select “Really enable proxy?” and type Y to confirm (or N to cancel). 


ET WP METMONR 
Change proxy params > Proxy parameters > ToxyFQDNAP  2600abe: 1234:132d 


Renew Automatic IPv6 on LAN 
Follow these steps to renew the network configuration on LAN when using automatic IPv6. 


Access the Scanner Console. Select “Set up network (LAN)”, then select “Renew automatic 
IPv6” from the sub-menu. Select “Apply automatic IPv6 configuration on LAN?” and type Y 
to confirm (or N to cancel). 


Note: If configured manually, IPv6 DNS1 and IPv6 DNS2 resolvers will take precedence 
over the DNS resolvers acquired from DHCPv6 and RADVD. 


Set up network (LAN) > Enable manual Pv config > SLAAC adore 
Dle proxy Renew automatic [Pv > 


Apply automatic IPye configuration on LAN? (tM) 
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Switch Between Modes 
Easily switch between IPv4+v6 and IPv6-only network modes. 


Access the Scanner Console. Select “Reset network settings” from the main menu. In the 
sub-menu, you ll see the option “Reset to IPv4+v6” if you re in IPv6-only mode, or you'll see 
the option “Reset to IPv6 only mode’ if you're in IPv4+v6 mode. Select the reset option and 
type Y to confirm (or N to cancel). 


© Qualys. Scanner Console 


Name: v$canner, LAN IP: 


Sar 

1 TR 

LE TE NE 
a 


Reset network settings > Reset all settings? (+ 
Svstem shutdown > Reset to [Pv only mode? (YN) 
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Troubleshooting 


Why do I see an Activation Code? 


@ Qualys. 


Welcome to the Qualys® Scanner Console 


[ACTIVATION CODE: 1564 


The Scanner Console displays ACTIVATION CODE in some cases: 


- You powered on the Scanner before entering the Activation Code using the Qualys portal 
UI. Click here for the activation steps 


- You entered the wrong Activation Code using the Qualys portal UI, 1.e. the Scanner has 
another activation code. 


- You entered the Activation Code following the activation steps but used the wrong 
Qualys Cloud Platform, e.g. the Scanner is licensed for US Platform 1 instead of US 
Platform 2. 


Communications Failure message 


The COMMUNICATION FAILURE message appears if there is a network breakdown 
between the scanner and the Qualys Cloud Platform. 


The communication failure may be due to one of these reasons: the local network goes 
down, Internet connectivity is lost for some reason, or any of the network devices between 
the scanner and the Qualys Cloud Platform goes down. 


Note the sequence of events following a network breakdown: 


- If there are no scans running on the Scanner: The next time the scanner sends a polling 
request to the Qualys Cloud Platform, the polling request fails, and then the 
COMMUNICATION FAILURE message appears. 


- If there are scans running on the Scanner: The COMMUNICATION FAILURE message 
appears after the running scans time out. In this case it is recommended you cancel any 
running scans and restart them to ensure that results are accurate. 


Once the network breakdown is resolved, you'll see the scanner friendly name and IP 
address and you scan start new scans. 
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The COMMUNICATION FAILURE message remains until the next time the Scanner makes 
a successful polling request to the Qualys Cloud Platform. There may be a lag time after 
the network is restored and before the scanner is back online, depending on when the 
next polling request is scheduled. Additional time is necessary for communications to be 
processed by a Proxy server if the scanner has a Proxy configuration. 


Appliance Network Errors 


An appliance network error indicates the Scanner attempted to connect to the Qualys 
Cloud Platform and failed. For details on troubleshooting and a list of possible errors, 
please visit Scanner Appliance Troubleshooting and FAQs. 


Important! The Scanner is not functional until the error is resolved. 
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Product Specifications and Credits 


Model number QGSA-1330-A2 


Software Credits 


Portions of the software embedded in the Qualys Scanner Appliance were 
developed by third parties and are governed by the terms and conditions 
detailed in the following Qualys document 


Qualys Scanner Appliance Software Credits 
https://www.qualys.com/docs/qualys-software-credits-scanner-appliance.pdf 


Product Specifications 


Configuration 

CPU Intel Celeron Quad-Core 2.00 GHz, 2M Cache 
Memory 4 GB DDR3-1333 

Hard Drive 500 GB, 2.5”, SATA 6 Gb/s, 5400 RPM 
Ethernet Two GbE ports 

USB Two USB 2.0 ports 


Power Input 


100-240 VAC, 50-60 Hz to AC-DC Adapter 12 VDC, 40W 


Power Consumption 


AC-DC Adapter 12 VDC, 40W 


Dimension 1.73 (H) x 8.19 (W) x 7.13 (D) inches 
Weight 3.96 Ibs: 
Environment 


Acoustic Noise 


~24 dBA at 23°C 


Operating Conditions 


0°C to 40°C, 0 to 5,000 feet, 5 to 85% RH 


Storage Conditions 


-20°C to 75°C, 5 to 95% RH 


Operating Vibration 


0.5 Gms, 5-500 Hz, 30 minutes per axis 


In-Package Shock 


In accordance with GB/T 2423.8-1995 Part 2; Test Ed 
(IEC 60068-2-32:1990-1995 IDT equivalent) 


Regulatory UL 
EMC FCC 
Environmental RoHS, WEEE 


Other certifications 


Per specific requirements 


Al 


